a1b92ebd2e1d4d9bedfe502959d8fe3824d0c6c397a98f539a9b95fdfc0cd5f6

Analysis

user interaction
yes
max time kernel
22s
max time network
18s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Prestige Injector.exe
Size 35.3MB
Sample260925-vt1lssts2r
SHA256 a1b92ebd2e1d4d9bedfe502959d8fe3824d0c6c397a98f539a9b95fdfc0cd5f6
MD5 d79f2fbcfcceaf3676047c296d2119e6
SHA1 a02d77833dc96d3388b808abb486e170f79a76c5
SHA512 70928c30f7591e05dc45822c5d47f1b1a54d169a1ace4b9621607659c409328a7a28b61f48965042326e5c1c447acf4478b2de0e3926dee80549cd4d5072996a
SSDEEP 786432:4KUlisR67UeXEtLYiZR+u6hggHh5Cmah9bOFnlypt4Mqdy6:4OE8U4SNb6WMvCdDbOFDv
TLSH
T15F8701D272E04169C162DA7AC663EB1FD33FB4215B16638B2195AB1A5E43780FE34F34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion spyware trojan

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\936CDBA49963307FC509C72CD04E8D0CE0F7DADC\Blob = 030000000100000014000000936cdba49963307fc509c72cd04e8d0ce0f7dadc200000000100000039030000308203353082021da00302010202144abf3bc4e823c23fe46e28f486aa316c70c18084300d06092a864886f70d01010b050030283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f7879301e170d3236303930353031353033395a170d3336303930323031353033395a30283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f787930820122300d06092a864886f70d01010105000382010f003082010a0282010100b06f3c76bd287f1201f00ee106202e129ce565e9fa7c506b25f67653a732d4748134d9d83e0d882c28fd5081873bcba5211b65b1e0dd73ba172f89df8b1a735154573e1cbc1845096617c1120090f776be8243db93e3761cba55c28e72db70d6baa85b3fdc3731adea8041349053c2f1685e2a56a40e31f4c76c973c8272f1a636291693056fddc8a2fc45a20784a90fefcef24fc1c51fecda84a9834e82223697f7c4c3119f0d3dad6ddf6670a2074eef9839395d8e184deefcb42f887f64766a0ac1dac87664c29f512559a138aca1d9bee1852e658365e0ad729f01d987bd8740c7cc66601ea03a3bdfe37f55e8bf52490044bf936478ebd0baea87981e4d0203010001a3573055300f0603551d130101ff040530030101ff30130603551d25040c300a06082b06010505070301300e0603551d0f0101ff040403020106301d0603551d0e04160414fdbb3e6c8b88e47ab712b7a1b38a42305a38b60c300d06092a864886f70d01010b05000382010100346c58d908e7ec20f91774dd5827415fa878931f1f16269f42dc1f230d1f4e556b2374524ed01b17ef2fb904327c75a8844a315da6bd09bb578950b19d804fd5968aa5ab9455e5840dd658bde45d42e65c42323b2e9bf2fa1eb8b17fecdd0ad5a455831e69ebd0a164d059ae6c04741c936160a30f21724bb6ea81ea0fe7ff24c9b3caae2862fee0e87136f6368f676c3bce234e8238a981652f82d50100cf4ca4a01a6ff87cac90de7795c17fb6d352ce2da07a3c1cbfb68de8d306df183d3df1f5edb53d970176500bd9b1a8b5ac1ec6391b30f5b0209d593acb0b3c64f6eafad2a9528b9809c1637bfcc4aa7319440d55b721fcf4cba767d58fd2c1b760bc	Prestige Injector.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\936CDBA49963307FC509C72CD04E8D0CE0F7DADC	Prestige Injector.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe
3600	Prestige Injector.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3600	Prestige Injector.exe

C:\Users\Admin\AppData\Local\Temp\Prestige Injector.exe
"C:\Users\Admin\AppData\Local\Temp\Prestige Injector.exe"
1⤵
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Inter.ttf

Path C:\Users\Admin\AppData\Local\OpenPrestige\Inter.ttf
Size 856KB
SHA256 29160a80ff49ddcab2c97711247e08b1fab27a484a329ce8b813d820dc559031
MD5 bff0f6e3b9e2259a28313168a907054f
SHA1 97d4f3722d62c6cc5340bf6220ada3d64ca367b1
SHA512 3b71d2ca0b0b7649d939f982fe5b973c913c4b0a89e1b07ea6b8b1fcf5f8c8f25b5cf293936f936b1e8b43831ea976bd82151cd0ad0d2847b254f6a3ac0b7f9c
SSDEEP 24576:PY598csuuuPz2iKeRpz6iruEOwRy+4FFhex:PYv8cB2iKeRpz6iar9FU
TLSH
T136158D53F682CF5AC259273486B30B9962395871FF17030F596A33B8BE933E1694D6E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpC38A.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpC38A.tmp
Size 1KB
SHA256 66958b31ab05b82fecd628de7eacebc318582b89e95880587df35578b0fe0f6a
MD5 46e389512b7e53b8cd2a39a1641f19a1
SHA1 6d99e97755921bbb40a26793d6625b1f49e7004c
SHA512 5d8ae4f34f3abb805a76323a2b01b9badaaefa85af15b31cd476ab8b647d237edf396ef8968d362639b03d0f0ea9fac44f0084c0d474b21c3de153ab7e187e8b
TLSH
T17321AA68CE7145155D9FF02655AFC585443CD31128AE7C7E29433567BB4B13D077CD84
MD5 SHA1 SHA512 TLSH

Submit Download

TmpC3CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpC3CA.tmp
Size 2KB
SHA256 7dce6442311f6a6510810569ff964fe4574d00650fbd99cc626b9c09430d319c
MD5 d05de659f10754eee52d582cc090ffba
SHA1 520f9f18c8a4bd37ce754b49e5f2ba429c353be4
SHA512 4310347afeb6a6201a970bdcbe35ea0664109168b3520879a5321646c74264b01e1e254b0da82f81857ccce668eebac0cde6b5a6ee6a2c72b4db61121746bc03
TLSH
T11C512B53605A46A4BD6CCE2C1D0BD3405BE9C626D9923A9EB8F1518ACDD03B1EC1C51F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3600-0-0x00000000009F0000-0x0000000002D42000-memory.dmp

Download

memory/3600-1-0x000000001DAB0000-0x000000001DAC0000-memory.dmp

Download

memory/3600-15-0x000000001DAB0000-0x000000001DAC0000-memory.dmp

Download

memory/3600-42-0x000000001E590000-0x000000001E5A2000-memory.dmp

Download

memory/3600-46-0x000000001DAB0000-0x000000001DAC0000-memory.dmp

Download

memory/3600-47-0x000000001DAB0000-0x000000001DAC0000-memory.dmp

Download

memory/3600-48-0x000000001DAB0000-0x000000001DAC0000-memory.dmp

Download